Welcome to RBT’s second blog. In it, we share one of our recent engagements: conducting an Internal Pentest for one of our manufacturing trusted clients. We also provide information on how domain admins can improve their Active Directory (AD) and Microsoft 365 environments.
Internal Penetration Test
Our client has taken all necessary security measures to safeguard their systems, including applying all security patches in a timely manner. Therefore, our assessment focused primarily on identifying misconfigurations through manual review. While conducting our investigation, we found that the network used three different protocols: Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Service (NBT-NS), and Internet Protocol version 6 (IPv6).
The Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based on the Domain Name System (DNS) format and allows hosts on the same local link to resolve names for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. Adversaries may spoof an authoritative name resolution source to force communication with an adversary-controlled system. This activity may be used to collect or relay authentication materials.
IPv6 DNS Spoofing, Microsoft Windows Vista and newer versions are configured to enable IPv6 by default, making it the preferred protocol over IPv4. However, this configuration can lead to DNS spoofing attacks, allowing malicious actors to control the network.
Our team successfully executed an IPv6 DNS spoofing attack, enabling us to capture several NetNTLMv2 password hashes. Later, we cracked these hashes locally to obtain the clear-text passwords, revealing potential weaknesses in the network protocols.
Continuing our journey, we initiated NTLM relay attacks over IPv6. Using the relayed hashes, we performed a Resource-Based Constrained Delegation (RBCD) attack, which allowed us to create a new computer account with delegation rights on two domain-joined computers.
Resource-Based Constrained Delegation (RBCD) is a feature available in Windows Server 2012 and later versions. It enables administrators to delegate permissions more securely and control by allowing the delegation configuration to be set on the target resource instead of the source. RBCD improves resource management by giving administrators greater control over permission delegation.
By requesting a local administrator Ticket Granting Ticket (TGT) using the newly created computer account credentials, we obtained over 10 Windows hashes from two domain-joined computers.
Diving deeper into the post-exploitation phase, we used the previously obtained hashes as a stepping stone for lateral movement within the network. We executed a password spray attack and gained administrative access to over 30 computers, revealing that the same password was reused across these computers, underscoring a critical security lapse. This discovery opened up new avenues for our attack, paving the way for the next phase.
When it comes to an attack in a real-world network scenario, the main concern is obtaining valid domain credentials, which is a challenge. Once a clear text valid credential was obtained from the users’ description, we used Bloodhound, a security tool, to identify highly complex attack paths that would otherwise be impossible to identify quickly.
Continuing our post-exploitation phase, the most significant breakthrough came when we obtained clear-text credentials for over 15 domain users by exploiting a misconfiguration in the Local Security Authority Subsystem Service (LSASS) process, providing unprecedented insights into the network environment.
After obtaining the clear-text passwords, our next step was to perform user enumeration in Bloodhound. Two users were identified as members of the RDP group on the domain controllers. Leveraging these credentials, we accessed the domain controllers and discovered significant sensitive and critical business-related data.
From On-Premises AD to M365
Further enumeration showcased that the client utilized Azure Active Directory (Microsoft Entra) and the Microsoft Office 365 suite. Exploiting the “trusted IPs” feature of Microsoft Entra multi-factor authentication, we bypassed MFA prompts by routing our traffic through their network using a SOCKS proxy. This strategic move granted us access to more than 15 users’ Office 365 suites, including Outlook, SharePoint, calendars, etc.
With our client’s permission, we reset a user’s password by following instructions in an unencrypted email, thereby gaining access to one of the most critical business web applications.
Finally, we gained external access to a business-critical web application, which was a progress product used to manage internal infrastructure.
Conclusion
During the weeklong penetration test, we thoroughly examined the internal network. We aimed to identify any vulnerabilities, even minor ones, and improve our client’s security posture. We also analyzed the complexities of network vulnerabilities and gained critical insights, highlighting the importance of implementing strong security practices.
Key Takeaways To Implement Security Measures
- Enable Multi-Factor Authentication (MFA) on both trusted and untrusted networks in Microsoft Entra.
- Do not store passwords in clear text in the description field.
- Encrypt sensitive emails to enhance data security.
- Via Group Policy Object, disable the unnecessary Link-Local Multicast Name Resolution (LLMNR) and Internet Protocol version 6 (IPv6) protocols.
- Do not reuse passwords across the internal network.
- Establish strong and secure credential policies within the internal infrastructure.
- Enable Windows Defender Credential Guard to isolate and protect sensitive credentials, such as password hashes, from theft.
Our penetration test helped our client identify specific vulnerabilities and provided practical recommendations for proactive security measures. These insights can guide our clients in strengthening their security measures and establishing a resilient defense against potential threats.
Join us on our next exciting adventure through the digital realm, where we continue contributing to strengthening security measures. Keep an eye out for upcoming blog posts like this one!
References
Resource-Based Constrained Delegation (RBCD)
Local Security Authority Subsystem Service (LSASS)
Link-Local Multicast Name Resolution (LLMNR)
MFA Setting with Trusted IPs
At RBT Security, we are dedicated to securing organization’s defenses with state-of-the-art offensive cybersecurity services. With a diverse team boasting over 15 years of industry experience, we excel in Red Team Operations, Adversary Emulation, and Purple Team assessments to rigorously test and strengthen your defenses against sophisticated threats. Our expertise extends to comprehensive penetration testing, covering Cloud, Application, Network, Wireless, Social Engineering, and Mobile environments. We prioritize thoroughness and accuracy by employing a manual approach, ensuring that our solutions are not only precise but also tailored to meet the unique needs of your business.